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1  Introduction 

Cursor  On  Target  (CoT)  is  a  technical  approach  for  enabling  systems  to  communicate  time 
sensitive  position,  or  "What,  When,  Where",  information.  CoT  leverages  Extensible  Markup 
Language  (XML)  technology  and  defines  an  extensible  message  format  for  communicating 
this  information.  The  schema  are  supported  by  a  suite  of  powerful  applications  that 
facilitate  data  translation,  software  development,  and  system  integration.  CoT  translators 
exist  for  Link-16,  VMF,  Google  Earth  and  FalconView.  CoT  is  operationally  deployed  24x7 
worldwide  in  over  300  systems. 

MITRE  works  in  the  role  of  System  Engineer  for  the  Cursor  on  Target  Program  Office 
(managed  by  AFLCMC/HNAG  at  Hanscom  AFB).  MITRE  not  only  provides  Configuration 
Management  /  Change  Control  for  the  schema  and  key  applications,  we  also  provide  “best 
practices”  for  development  of  CoT-enabled  systems,  deployment  of  CoT  data  architectures, 
and  concepts  for  integration  of  CoT  into  Enterprise  networks.  With  over  1,700  users  in  the 
CoT  User  Group,  MITRE  (as  directed  by  our  government  customers)  endeavors  to  provide 
training  and  venues  for  exchanging  information,  future  requirements,  and  operational 
concerns.  The  key  event  each  year  is  our  CoT  Annual  User  Group  Meeting,  which  has 
historically  been  hosted  in  the  Boston  area. 

This  year’s  5th  Annual  User  Group  Meeting  built  upon  the  2013  Meeting,  which  was  opened 
for  the  first  time  to  International  participation  to  address  the  growing  international 
interest  in  CoT. 

The  challenge  of  foreign  participation  is  based  upon  our  constraints  in  sharing  technology 
with  non-US  citizens;  International  Traffic  in  Arms  Regulations  (ITAR)  require  State 
Department  approval  for  such  discussions.  Recognizing  these  restrictions,  we  developed 
presentations  that  were  suitable  for  Public  Release  and  split  the  meeting  into  two  sessions. 
Invitations  were  sent  to  known  international  users  of  CoT  with  the  notice  that  we  would 
welcome  all  users  /  potential  users  on  the  first  day  of  the  meeting.  On  the  second  day,  we 
restricted  our  invitations  to  US  citizens  with  a  “need  to  know”  as  FOUO  material  would  be 
discussed. 

Additionally,  understanding  that  the  budgetary  impact  of  Sequestration  would  dramatically 
limit  the  ability  of  our  US  government  users  to  travel,  we  developed  a  virtual  environment 
for  not  only  presentations  but  also  Integration  Testing  of  CoT-enabled  systems. 

We  had  four  primary  goals  for  the  Annual  Meeting: 

•  Provide  interesting  presentations  that  demonstrate  the  value  of  Cursor  on  Target 

•  Present  technology  updates  and  recommended  “best  practices”  for  development 
and  deployment  of  CoT-based  systems 

•  Conduct  a  Digital  Exercise  (DIGEX)  to  enable  integration  and  testing  of  user  CoT- 
enabled  systems 

•  Provide  training  for  CoT  developers  and  system  architects 
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The  attendees  consisted  of  92  people  who  physically  met  in  the  MITRE-Bedford  location, 
and  62  who  attended  virtually.  We  had  10  people  who  participated  in  the  DIGEX. 

We  received  43  completed  surveys  from  the  attendees,  and  feedback  indicates  that  the 
FY14  Annual  user  Meeting  was  a  success  from  the  perspective  of  the  participants.  When 
compared  to  the  feedback  from  2013,  ratings  went  up  in  all  categories. 
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2  Agenda 


Topic 

Presenter  Time 

Comments 

DAY  1:  1  April  2014 

Introduction 

Jon  Jacoby  (MITRE) 

0800-0830 

•  Welcome 

•  Meeting  framework  and 
concept 

•  Desired  outcomes 

•  Logistics 

ITAR  Briefing 

Karl  Abendschein 
(MITRE) 

0830  -  0845 

•  Identify  constraints 
regarding  what  is  being 
presented,  what  can  be 
discussed 

•  All  presentations  must  be 
Approved  for  Public 

Release 

•  Who  to  contact  for 
additional  information 

Use  of  CoT  in  Fire 

Fighting 

Luke  Savoie  (ForceX) 

0845-0915 

Use  ofISR  to  facilitate 
International  Operations 

Paul  Hastert  (HAF/A2I) 

0915-0945 

•  Common  requirements 

•  System  Integration 

Enterprise  Integration 
DIGEX  overview 

Mike  Dinsmore  (MITRE) 

0945  -  1015 

•  Scenarios 

•  Gaming  rules 

•  Evaluation  criteria 

BREAK 

1015-1030 

Android  Tactical  Assault 

Kit  (ATAK)  Licensing 
Opportunities 

Ralph  Kohler  (Air  Force 
Research  Lab) 

1030  -  1115 

•  ATAK  Capabilities  / 
Architecture 

•  Movement  to  Open 

Source 

Battlefield  Air  Operations 
(BAO)  Kit 

Major  Tim  Forbes 
(AFLCMC/WISN) 

1115-1200 

•  Presented  by  Capt 

Jonathan  Wing 

LUNCH 

1200  -  1300 

Geospatial  Routing:  A 
Reference  Architecture 

Matthew  Kern  (Federal 
Enterprise  Architecture 
Certification  Institute) 

1300-  1345 

•  Search  and  Rescue 

•  Interface  between  Military 
and  Civilian  organizations 

•  Counter  Terrorism 

AFLCMC  support  for 

FMS  Cases 

Don  Seta 

(AFLCMC/HNAD) 

1345  -  1415 

Use  of  CoT  for  delivery  of 
Weather  data 

Major  Owen  Somers 
(AFLCMC/HBAW) 

1415-1500 

•  FalconView  integration 
with  weather  data 

•  Discussion  of  tools  and 
capabilities 

CoT  Fundamentals 

Ernie  Carozza  (MITRE) 

1415-1500 

CoT  DIGEX 

Mike  Dinsmore  (MITRE) 

1415  -  1545 

CoT  SDK  2.0  Tutorial 

Laura  Bonanno  (MITRE) 

1500  -  1545 

BREAK 

1545  -  1600 

Wrap-Up 

Bill  Leavis 
(AFLCMC/HNAG) 

1600  -  1630 

•  DIGEX  results  evaluation 

•  Gather  feedback  from 
users  regarding  Day  1 
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DAY  2:  2  April  US  Only 

Morning  Kickoff 

Jon  Jacoby  (MITRE) 

0800-0815 

CoT-NIEM 

Lizzie  DeYoung  (MITRE) 

0815  -0845 

•  Requirements 

•  Design 

Small  UAV  RF  emitter 
Geo-location 

Jason  Bales  (Azure 
Summit) 

0845  -0915 

Digitally  aided  PR  in  low 
intensity  conflict 

Col  Steven  Butow  (129th 
Rescue  Wing) 

0930-  1000 

BREAK 

1000-  1015 

Use  of  CoT  in  Wide  Area 
Surveillance 

Luke  Savoie  (ForceX) 

1015-1100 

AFSOC  Use  of  CoT: 

BAO  Kit 

Major  Tim  Forbes 
(AFLCMC/WISN) 

1100-1130 

•  Presented  by  Stephen 
Danforth 

ATAK  Roadmap 

Ralph  Kohler  (Air  Force 
Research  Lab) 

1130-  1200 

LUNCH 

1200  -  1300 

CoT  Mil-Standard 

Mike  Cokus  (MITRE) 

1300-  1400 

•  Current  Status 

•  Issue  discussion 

Requirements  Gathering 
for  FY14  /  FY15 

Jon  Jacoby  (MITRE) 

1400  -  1530 

CoT  DIGEX 

Mike  Dinsmore  (MITRE) 

1400  -  1530 

Wrap-Up 

Bill  Leavis 
(AFLCMC/HNAG) 

1530-  1600 

DIGEX  results  evaluation 
Gather  feedback  from 
users  regarding  Day  2 

3  Technical  Architecture 

3.1  Overview 

Past  user  group  meetings  have  consisted  of  presentations,  discussions,  and  integration 
scenarios  with  real  CoT  systems  on  a  local  area  network.  While  this  year’s  meeting  was 
planned  in  a  similar  format,  it  was  highly  desirable  to  extend  the  meeting  to  remote  users 
as  well.  For  the  presentation  and  discussion  portions  of  the  meeting,  a  conferencing  tool 
was  required  to  share  audio  and  slides.  Coordinating  a  digital  exercise  that  allowed  remote 
users  to  connect  to  a  local  network  was  more  complicated.  The  decisions  to  use  Defense 
Connect  Online  (DCO)  and  MITRE’s  Information  Sharing  Experimentation  Environment 
(ISEE)  to  conduct  the  virtual  aspect  of  the  user  group  meeting  met  the  requirements  and 
worked  well  for  most  of  the  event. 

3.2  Conferencing  Tools 

In  designing  the  infrastructure,  we  selected  our  tools  based  upon  the  following 
requirements: 

•  Must  be  able  to  share  audio  and  slides 

•  Should  be  able  to  share  video 

•  Must  allow  external  users  to  deliver  presentations  as  well  as  listen 

•  Must  be  able  to  verify  the  identity  of  external  users,  if  access  needs  to  be  limited  to 
US  citizens 
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•  Must  be  able  to  handle  at  least  200  connected  users 

At  the  2013  CoT  users  Group  Meeting,  Microsoft  Lync  was  selected  as  the  conference  tool, 
due  to  its  successful  use  within  MITRE.  There  are  two  main  limitations  with  using  Lync 
hosted  at  MITRE  for  this  event: 

•  Users  outside  of  MITRE  can  join  as  guests,  but  there  is  no  way  to  coordinate 
accounts  with  them  in  advance.  In  small  meetings,  this  is  acceptable,  since  the 
identity  of  guests  can  be  verified  by  voice.  For  a  large  meeting  such  as  this,  that  is 
not  practical. 

•  Both  in  Lync  2010  and  Lync  2013,  the  ability  to  receive  audio  as  a  client  requires  the 
installation  of  additional  software  with  an  administrator  account.  This  was 
problematic  at  the  2013  CoT  users’  Group  meeting  for  many  users,  in  particular 
government  users,  who  do  not  have  administrative  privileges  on  their  machines. 

With  respect  to  the  other  requirements,  both  versions  of  Lync  were  judged  to  be  adequate. 
This  year,  Defense  Connect  Online  (DCO)  was  selected  as  the  conferencing  tool  specifically 
because  it  offers  some  improvement  for  these  two  above  points: 

•  DCO  also  does  not  provide  pre-coordination  of  guest  accounts,  and  so  it  suffers  from 
the  same  troubles  as  Lync  for  “guests."  However,  on  DCO,  only  users  who  do  not 
have  a  Common  Access  Card  (CAC)  join  as  guests,  whereas  with  Lync,  all  non-MITRE 
employees  would  join  as  guests. 

•  There  are  two  variants  of  the  DCO  web  client.  For  users  who  do  not  need  to  present 
or  use  their  microphones,  only  Adobe  Flash  is  required.  Since  all  modern  computers 
have  Flash  installed  already,  using  DCO  reduces  the  installation  troubles  for  users  as 
well  as  the  amount  of  time  CoT  Program  Office  staff  need  to  spend  performing 
helpdesk  services. 

In  either  case,  the  most  challenging  requirement  was  related  to  identification  of  external 
users.  For  some  discussions,  we  needed  to  limit  participation  to  US  citizens  only.  Ideally, 
we  would  be  able  to  pre-coordinate  "guest  accounts"  for  remote  users  to  ensure  only 
authorized  users  would  have  access.  The  only  option  at  this  point  in  time  is  for  users  to 
join  as  "guests,"  supplying  a  guest  name,  and  waiting  for  a  host  to  admit  them  to  the 
meeting. 

One  drawback  of  DCO  is  that  it  is  purely  web  based  -  there  is  no  option  to  dial  a  phone 
number.  This  presented  a  problem  for  a  remote  presenter  who  informed  CoT  Program 
Office  staff  an  hour  before  presenting  that  he  did  not  have  a  PC  microphone.  As  a  stopgap, 
CoT  Program  Office  staff  created  a  Lync  conference  and  quickly  implemented  a  bridge 
between  the  Lync  conference  and  DCO  conference.  The  remote  presenter  was  able  to  use 
the  Lync  conference  number  for  bidirectional  audio  during  his  presentation.  The  steps  to 
configure  the  bridge  are  outlined: 
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•  Set  up  a  computer  connected  to  the  DCO  meeting.  Have  this  user  promoted  to 
"Presenter"  so  that  it  can  speak. 

•  Set  up  a  second  computer  connected  to  the  Lync  meeting. 

•  Using  two  3.5mm  audio  cables,  connect  the  speaker  output  and  microphone  in  ports 
on  the  two  computers  in  "cross  over"  configuration:  speaker  output  connected  to 
microphone  input  on  the  other. 

•  Adjust  volume  levels  on  both  computers  to  an  acceptable  level. 

3.3  The  Virtual  Environment 

A  highlight  of  past  user  group  meetings  was  the  ability  for  developers  to  bring  their 
systems  onto  a  network,  exchange  CoT  messages  with  each  other,  and  receive  feedback 
from  other  users.  This  is  helpful  for  new  systems  as  well  as  existing  systems,  as  they  have 
the  opportunity  to  test  and  rapidly  integrate  with  other  systems. 

This  year,  a  local  area  network  was  setup  in  the  Agile  Capability  Mashup  Environment 
(ACME)  Lab  at  the  Bedford  MITRE  office  to  connect  user  group  meeting  attendees  who 
arrived  in  person.  We  also  wanted  to  support  "virtual  collaboration"  by  enabling  external 
users  to  connect  into  this  network.  MITRE’s  Information  Sharing  Experimentation 
Environment  (ISEE)  provided  the  infrastructure  to  support  this.  ISEE  is  a  MITRE  CI&T 
resource  that  provides  a  virtual  sandbox,  enabling  users  from  disparate  locations  to 
connect  and  collaborate  over  an  IP  network. 
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Network  Architecture 


Inside  the  ISEE  network,  a  virtual  local  area  network  (VLAN)  was  created  for  the  CoT  User 
Group  Meeting.  External  users  were  given  the  ability  to  tunnel  into  this  network  via  a 
virtual  private  network  (VPN).  At  the  MITRE  Bedford  office,  where  user  group  meeting 
attendees  arrived  in  person,  ISEE  provided  a  router  that  formed  a  site-to-site  VPN  with  the 
ISEE  lab  network.  The  hub  of  CoT  traffic  on  the  network  was  a  virtual  machine  (VM)  on  the 
CoT  VLAN.  This  VM  hosted  the  CoT  router,  used  to  receive  and  distribute  all  CoT  messages 
generated  by  participating  systems.  By  leveraging  the  existing  infrastructure  of  ISEE,  little 
additional  effort  was  required  to  build  this  network  and  make  it  available  to  users.  Future 
events  could  also  provide  an  InfoSec  approved  wireless  access  point  for  local  participants 
that  wish  to  send/receive  CoT  using  mobile  devices. 


3.4  Pre-Meeting  Preparation 

Starting  in  February,  CoT  Program  Office  staff  conducted  weekly  or  biweekly  tests  of  our 
MITRE  facility,  the  audio  system  through  DCO,  and  the  Digital  Exercise  VPN  environment. 
We  conducted  some  of  these  tests  for  periods  in  excess  of  4  hours,  including  simultaneous 
DCO  meetings  to  verify  compatibility  with  lab  systems  and  determine  administrative 
requirements  for  the  event.  We  set  up  a  PC  on  MITRE's  "Outernet”  to  test  the  system  from 
the  perspective  of  online  users. 
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Some  of  these  tests  were  performed  in  the  auditorium  used  for  the  event.  For  these  tests, 
MITRE’s  Corporate  Audio/Visual  Services  (CAVS)  participated  to  simulate  the  real  setup. 
This  event  was  the  first  that  CAVS  supported  that  used  DCO  rather  than  Lync,  so  the  extra 
time  to  test  the  system  proved  very  helpful. 

3.5  DIGEX  Coordination  During  the  Event 

In  order  to  remotely  participate  in  the  digital  exercise  (DIGEX),  users  were  instructed  to 
contact  the  CoT  Program  Office  for  assignment  of  login  credentials.  These  users  received 
an  email  with  connection  instructions  and  access  to  the  Cisco  AnyConnect  VPN  client,  used 
to  connect  into  the  DIGEX  network. 

Once  users  are  networked  inside  the  VPN,  there  is  a  need  to  coordinate  configuration 
(ports,  protocols,  IP  addresses)  and  exercise  activities.  To  support  DIGEX  coordination  and 
collaboration,  a  separate  DCO  conference  was  setup  in  parallel  to  the  one  used  for 
presentations  and  discussions.  In  the  ACME  Lab,  where  the  DIGEX  was  physically  hosted, 
microphones  and  the  integrated  sound  system  enabled  verbal  communication  with  remote 
attendees.  Instant  messaging  was  also  available  via  DCO  when  voice  wasn’t  an  option.  To 
keep  track  of  network  configuration,  such  as  port  numbers  and  IP  addresses,  a  web  page 
was  hosted  on  the  network  that  could  be  updated  as  new  users  came  on  the  network. 


4  MITRE  Assessment 
4.1  Planning  and  Execution 

We  initiated  planning  for  the  FY14  User  Group  meeting  as  soon  as  we  were  permitted  to  do 
so.  One  effect  of  Sequestration  was  that  we  had  to  impose  a  "Stop  Work”  on  all  CoT-related 
program  work  until  the  end  of  October,  so  we  held  our  kickoff  meeting  in  November.  In 
retrospect,  this  delay  had  no  measurable  impact  upon  our  execution  or  performance. 

Key  tasks  in  this  year’s  execution  of  the  User  Group  meeting,  and  associated  "lessons- 
learned: 


Task 

Description 

Lessons-learned 

Kickoff  meeting 

Identify  roles, 
responsibilities,  draft 
schedule,  desired 
outcomes 

Needs  to  be  conducted  in  October  or 
November,  with  follow-up  meeting  in 
mid-December 
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Task 

Description 

Lessons-learned 

Selection  of 
meeting  facilities 

Identify  options  for 
hosting  the  meeting. 
Evaluate  availability  of 
food  /  drink,  meeting 
expenses,  security, 
parking,  availability  of 
meeting  rooms  for 
sidebar  discussion 
(including  Classified 
meetings) 

MITRE  facilities  continue  to  come  out  on 
top  in  the  selection  process.  Cost  is  built 
into  the  AF  contract,  and  Security  is  built- 
into  the  environment. 

There  are  ample  meeting  rooms  which 
can  hold  from  UNCLASS  up  to  TS/SCI 
sidebar  discussions. 

If  the  C  Building  auditorium  (2C130)  is 
reserved,  there  is  ready  access  to  the 
cafeteria  and  Starbucks  coffee  bar  in  an 
area  where  all  can  travel  without  escort. 

Use  of  the  ACME  facilities  adjacent  to 

2C130  provides  an  excellent  venue  for 
collaboration,  presentations,  and 
training. 

The  key  is  early  reservation  of  2C130  and 
the  ACME  lab  facilities.  Recommend  that 
this  be  done  in  early  October  for  an  April 
meeting. 

Call  for  papers 

Submit  request  for 
presentations, 
identifying  any 
unifying  theme(s)  and 
key  Stakeholder 
participation 

We  waited  too  long,  submitting  this 
request  in  January.  We  should  have  done 
so  in  November. 

One  of  the  challenges  with  doing  so  is  that 
many  presenters  /  organizations  do  not 
have  core  competencies  in  the  areas  of 
long-term  planning  and  scheduling. 
Moreover,  even  under  perfect 
circumstances.  Operational  Requirements 
must  trump  ancillary  activities  (like 
participation  in  a  User  Group  Meeting). 

Given  the  uncertainty  associated  with  our 
planning  Agenda,  recommend  that  at  least 
one  presentation  be  developed  as  a 
backup  for  the  International  Day 
(presentation  must  be  approved  for 

Public  Release)  and  one  for  US-only  Day 
(if  a  MITRE  presentation,  must  go  through 
the  Limited  Release  process). 
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Task 

Description 

Lessons-learned 

Effective 
management  of 

CoT  User  Group 

contact 

information 

Maintain  a  current  list 
of  users,  identifying 
which  users  possess 

US  citizenship;  keep 
email  and  phone 
numbers  up  to  date 

The  CoT  Program  Office  was  negatively 
impacted  by  the  massive  change  of  email 
addresses  occurring  in  FY14.  Many  of  the 
emails  were  undeliverable,  and  we 
needed  to  continually  search  the  Global 
Address  List  (GAL]  in  attempt  to  keep  in 
contact  with  the  users.  This  problem  was 
exacerbated  in  that  the  MITRE  GAL  only 
updated  the  Air  Force  addresses  (e.g.,  we 
were  missing  USSOCOM,  Army,  Navy, 

USCG  addresses],  and  currency  from  one 
day  to  the  next  was  inconsistent.  In  some 
cases  we  needed  to  use  "word  of  mouth” 
to  communicate  news  about  the  Meeting. 

User  credentials 

Identify  those  users 
who  have  both  US 
citizenship  and  "need 
to  know”  for 
participation  in  Day  2 
(US  Only]  meetings 
and  technical 
exchanges. 

We  were  able  to  leverage  the  CoT  User 

List  file  to  pre-clear  those  who  we  had 
already  validated  for  access  to  the  CoT 
sharepoint  site  on  SoftwareForge.mil. 

However,  for  classified  meeting  sidebars, 
we  still  requested  that  individuals  send 
their  credentials  via  JPAS.  We 
coordinated  with  MITRE  security,  and 
established  expectations  regarding  the 
processing  of  JPAS  or  faxed  information. 

We  requested  that  each  submission 
include  the  phrase  "CoT  User  Group 
Meeting”,  which  assisted  our  security 
team  in  processing  the  requests. 

Security 

preparation: 

Physical 

attendance 

Prepare  for  arrival  of 
meeting  attendees 

Develop  list  of  anticipated  participants; 
prepare  name  badges;  identify  all  foreign 
participants,  who  require  MITRE  escorts; 
coordinate  with  MITRE-Bedford  to  ensure 
that  sufficient  parking  would  be  available 
for  attendees. 

Signs  that  were  supposed  to  direct 
attendees  to  auxiliary  parking  SE  of  E 
Building  did  not  get  posted.  This 
generated  negative  feedback  from  a 
couple  of  attendees. 
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Task 

Description 

Lessons-learned 

Security 

preparation: 

Virtual  attendance 

Prepare  for 
attendance  via  web  / 
teleconference 

Develop  list  of  anticipated  participants; 
arrange  separate  login  ids  for 

International  Day  and  US-only  Day; 
coordinate  with  MITRE  Infosec  to  assess 
network  security  and  data  processing; 
develop  process  for  authentication  of 
attendees.  Note  that  there  will  be  a  cost 
for  the  assessment  (~  2  staff  days). 

Information 

Assurance 

Develop  plans  to 
process  documents 
and  data,  ensuring  that 
ITAR  constraints  are 
taken  into  account. 

Coordinate  early  and  often  with  both 
MITRE  Information  Assurance  and  Export 
Compliance  organizations.  Allow 
sufficient  time  for  review  and  approval  of 
documents  provided  to  the  user 
community. 

We  failed  to  allow  sufficient  time  for  this 
task.  Part  of  the  associated  problems 
were  generated  by  late  arrival  of  the 
presentation  materials  (2  presentations 
arrived  the  day  of  the  meeting  itself). 
Recommend  that  we  put  a  hard  delivery 
date  on  submittal  of  papers  next  year,  e.g., 
90  days  prior  to  the  meeting.  Note  that 
this  may  be  an  unachievable  goal  due  to: 

1)  lack  of  commitment  to  participate  on 
the  part  of  the  presenters;  and  2)  last- 
minute  cancellations  due  to  Operational 
and  other  priorities. 

As  mentioned  previously,  recommend 
that  there  be  a  minimum  of  one 
presentation  per  day  that  is  developed  as 
a  contingency. 

Communication 

Plan 

Develop  plan  to 
effectively  promote 
the  User  Group 
meeting 

Although  we  started  ramping  up 
communications  to  the  users  in  January, 
this  was  too  late,  and  the  users  were 
insufficiently  committed  to  attend  the 
meeting  until  very  late  in  the  game.  Our 
inability  to  create  early  commitment  led 
to  rapid-reaction  drills  and  a  lot  of  stress 
for  the  CoT  team. 

Note  that  this  pattern  of  "late 
commitment”  is  a  recurring  problem. 
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Task 

Description 

Lessons-learned 

Approximately  60  percent  of  the 
attendees  commit  to  participating  within 

30  days  of  the  meeting.  See  Appendix  B 
for  statistics. 

Recommend  that  we  subsume  this  plan 
into  an  overall  Communication  Plan  for 
the  CoT  Program  Office,  clearly  setting 
Milestones  and  expectations  for  coming 
events  and  deliverables. 

Key  deliverables  associated  with  the  User 
Group  Meeting  include: 

•  Emails  to  users  starting  in 
November,  identifying  schedule  of 
events  and  unifying  theme(s). 

"Hold  the  Date!”  message  should 
be  incorporated.  Also,  solicit 
presentations  and  system 
demonstrations. 

•  Call  for  CoT-Enabled  System 
documentation  (see  Appendix  A 
for  examples)  in  January.  Note 
that  some  system  information  may 
not  be  suitable  for  Public  Release. 

•  Hansconian  article,  submitted 
through  Hanscom  Public  Affairs 
(PA).  Submit  45  days  in  advance 
of  the  meeting,  for  publication  14 
days  prior  to  the  meeting.  Work 
with  PA  to  see  if  the  article  can  be 
promoted  to  the  AF  Journal. 

•  MITRE  Announcements  and 
Information  Displays  (MAID). 
Arrange  to  have  CoT  User  Group 
meeting  information  displayed  one 
month  prior  to  the  meeting,  and 
the  week  immediately  prior  to  the 
meeting. 
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Task 

Description 

Lessons-learned 

•  MITRE  Monday  Update:  arrange 
for  publication  on  the  two 

Mondays  prior  to  the  meeting. 

•  MITRE  FASTJUMP:  arrange  for 
website  to  be  set  up,  and  post  both 
Agenda  and  appropriate 
presentation  materials. 

Application 

Development 

Seek  to  provide  new 
applications  or  schema 
for  technical 
discussion  and 
evaluation 

We  allowed  ourselves  a  little  slack  in  this 
area.  Initially,  the  goal  was  to  have  the 

CoT  SDK  2.0  and  the  CoT-NIEM  translator 
available  for  release  at  the  time  of  the 

User  Group  Meeting.  As  events  evolved, 
we  determined  that  this  was  too 
aggressive,  and  settled  for  in-depth 
discussion  of  the  design  and  capabilities, 
and  demonstrations  of  the  technology  as 
of  the  date  of  the  meeting.  This  approach 
appeared  to  satisfy  the  user  community. 

Network  Test 

Ensure  that  network 
architecture  is  stable 
and  accessible 

We  published  multiple  emails  advising 
the  users  of  the  architecture  and  login 
requirements.  User  Connectivity  Testing 
was  accomplished  during  the  week 
immediately  prior  to  the  Meeting.  Even 
so,  some  users  failed  to  take  proactive 
measures  to  ensure  that  they  could  hear 
the  audio  and  view  the  video  of  the 
presentations.  One  presenter  waited  until 
90  minutes  before  his  presentation  to  let 
us  know  he  had  not  properly  prepared  his 
computer  for  connecting  to  our  network. 

Bottom  line  is  that  there  will  always  be  a 
need  to  react  to  unexpected  situations. 
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Task 

Description 

Lessons-learned 

Meeting  execution 

Adhere  to  the  Agenda, 
providing  an  effective 
learning  and 
collaboration 
experience 

For  the  most  part,  things  worked  well. 

However,  we  ran  into  a  situation  where 
two  different  presentations  scheduled  for 
Day  1  had  not  yet  been  approved  for 

Public  Release.  As  a  risk  mitigation,  we 
overbooked  a  timeslot,  anticipating  that 
one  (or  both)  presentations  would  not  be 
delivered.  As  things  turned  out,  both 
presentations  were  approved  on  the  day 
of  the  presentation,  and  we  ended  up  with 
too  many  things  occurring  at  the  same 
time.  The  overlap  in  activities  was  not 
well  communicated  to  the  audience,  and 
confusion  occurred. 

Presentation  overlap  may  be  a  necessary 
evil  with  so  many  moving  parts  in  a 
complex  meeting  environment,  but  we 
need  to  do  better  with  regard  to  meeting 
management  in  the  future. 

Presentation 

assessment 

Ensure  that 
presentations: 

1)  Are 

appropriate  for 
the  audience 

2)  Address  CoT 
capabilities, 
gaps,  concerns 

3)  Are  delivered 
by  someone 
familiar  with 

the  material 

Some  of  the  speakers  were  not  well- 
prepared.  For  next  year’s  event,  would 
recommend  that  we  host  a  walk-through 
of  the  presentations  during  the  week 
immediately  prior  to  the  User  Group 
Meeting.  During  that  session,  not  only  can 
the  presenter  gain  the  benefit  of  a  dry 
run,  but  the  CoT  Program  Office  can 
ensure  that  the  material  is  suitable  for 
delivery  to  the  User  Group. 
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4.2  Network  Architecture 

DCO  as  a  conference  tool  performed  well  for  most  of  the  two  day  event.  There  was  a 
significant  outage  from  about  1445  to  1515  on  the  first  day  of  the  event  that  affected  all 
DCO  users,  local  and  remote,  on  multiple  DCO  meetings.  During  this  time,  part  of  the  CoT 
SDK  briefing  could  not  be  broadcast  online,  and  the  remote  DIGEX  users  had  trouble 
communicating  with  the  hosts.  At  around  1515,  DCO  stabilized  again,  and  users  were  able 
to  reconnect.  As  far  as  we  can  tell,  we  had  no  control  over  this  outage  and  could  not  have 
resolved  it  on  our  own.  It  is  possible  this  is  an  indication  of  instability  of  DCO  as  a 
conferencing  tool. 

Aside  from  the  connection  outage,  DCO  provided  significant  improvements.  CoT  Program 
Office  staff  spent  significantly  less  time  during  the  event  performing  helpdesk  actions  and 
admitting  users  than  in  2013. 


Audio  in  the  auditorium  over  DCO  worked  very  well  with  the  exception  of  questions  from 
the  local  audience.  In  many  cases,  audience  members  did  not  turn  on  their  table-mounted 
microphones.  Often  we  were  unable  to  notice  or  interrupt  the  speaker  to  turn  their 
microphones  one,  so  the  audio  available  to  the  remote  users  on  DCO  would  momentarily  go 
quiet.  Use  of  the  microphones  in  the  ceiling  of  the  auditorium  was  considered,  but 
ultimately  turned  off  to  avoid  audio  looping  and  accidental  broadcast  of  side  conversations. 


The  level  of  participation  in  the  Digital  Exercise  was  lower  than  expected.  This  was 
partially  due  to  its  priority  in  scheduling.  In  addition,  it  is  possible  that  communication  of 
the  event  was  not  clear.  At  previous  CoT  User  Group  meetings,  many  users,  in  particular 
contractors,  were  very  interested  in  bringing  their  systems  to  demonstrate  and  integrate 
with  others.  It  is  possible  that  asking  users  to  participate  in  the  "digital  exercise”  is  too 
opaque  for  them  to  want  to  invest  time  and  resources.  In  the  future,  if  we  are  to  continue 
with  this  part  of  the  event,  it  should  have  a  dedicated  block  of  time  and  should  be 
advertised  along  the  lines  of  "connecting  to  a  network  with  other  users  and  simulation 
systems  for  demonstration  and  integration." 


4.3  DIGEX 

4.3.1  DIGEX  Coordination 

The  Digital  Exercise  [DIGEX)  supported  both  local  and  remote  participation.  Local 
participation  was  hosted  in  MITRE’s  ACME  lab  in  Bedford,  MA  and  the  remote  participation 
was  achieved  through  a  Virtual  Private  Network  (VPN)  data  connection  combined  with  a 
Defense  Connect  Online  (DCO)  collaboration  tools  session.  Remote  participants  received 
login  credentials  for  the  Cisco  AnyConnect  VPN  client  by  email  after  contacting  the  CoT 
Program  Office. 
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4.3.2  What  went  right 

Local  and  remote  developers  connected  their  systems  to  the  DIGEX  and  received  various 
dynamic  CoT  messages  provided  by  a  flexible  simulation  backbone.  As  in  past  years,  the 
Program  Office  made  use  of  MITRE’s  Resources  for  Early  and  Agile  Capability  Testing 
(REACT]  lab  to  provide  this  simulation  functionality.  This  year’s  scenario  provided  focused 
scenario  data  for  a  disaster  response  in  Haiti. 

The  process  of  gathering  DIGEX  simulation  requirements  began  in  January.  There  was  a  lot 
of  discussion  about  who  we  should  consider  the  "users"  at  the  DIGEX.  We  came  up  with  a 
few  key  requirements: 

•  Scenarios  needed  to  be  publicly  released 

•  Day  2  scenario  needed  to  emphasize  the  collaboration  between  DHS  and  DoD 

•  DIGEX  activity  needed  to  be  more  interactive  and  visually  compelling  rather  than 
the  "tracks  on  a  map"  visualization  of  past  years 

•  UAVs  with  Sensor  Points  of  Interest  needed  to  be  included 

•  Simulated  entities  needed  to  accept  tasking  from  participants 

•  DIGEX  needed  to  support  remote  participants  at  the  same  level  as  in-room 
attendees 

To  address  the  above,  the  REACT  lab  created  a  web-based  game  on  top  of  the  simulated 
entities  where  participants  respond  to  alerts  in  a  disaster  response  scenario.  One  team 
controlled  the  air  surveillance  assets  and  another  controlled  the  ground  repair  crews.  This 
technology  satisfied  the  engineering-level  data  collectors  as  well  as  the  high  level  VIP 
demonstrations.  Through  scoring,  REACT  was  able  to  demonstrate  the  benefits  of 
interoperability.  Teams  operated  first  in  a  "stovepiped”  configuration  where  they  could 
only  see  their  own  vehicles,  then  in  a  CoT-enabled  configuration  where  information  was 
shared  between  the  displays  for  better  situational  awareness. 
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The  ISEE  VPN  network  worked  very  well  as  the  backbone  for  the  DIGEX.  Once  the 
computers  were  configured  for  the  DIGEX  IP  network,  the  REACT  simulation  system 
worked  as  expected.  REACT-generated  CoT  messages  were  provided  on  the  network  and 
were  successfully  received  by  connected  systems.  The  management  of  the  event  by  ACME 
staff  was  very  well  done.  To  keep  track  of  network  configuration,  such  as  port  numbers 
and  IP  addresses,  a  persistent  note  on  the  DCO  session  provided  the  IP  and  port  numbers. 
The  REACT  Interoperability  game  was  successful  at  demonstrating  the  concept  and  benefit 
of  CoT  to  those  not  familiar  with  the  domain.  REACT  was  also  able  to  visualize  a  DHS/DoD 
drug  interdiction  scenario  as  a  foundation  for  the  CoT-NIEM  demonstration  on  day  2. 

A  popular  product  from  the  DIGEX  is  the  data  collection.  Several  participants  requested  the 
collect  and  commented  how  they  have  used  collects  from  previous  DIGEXes  in  their  CoT 
tools  development. 

4.3.3  What  went  wrong 

With  all  the  various  activities  scheduled  for  the  two  day  event,  the  agenda  proved 
problematic  for  the  DIGEX  with  many  sessions  overlapping.  On  day  one  of  the  DIGEX,  there 
were  several  developer-level  CoT  presentations  scheduled  during  the  same  time  slot  which 
made  engineering-level  participants  pick  one  or  the  other. 

The  DCO  system  did  not  perform  well  for  the  DIGEX  this  year.  Day  one  saw  a  crash  of  the 
DCO  collaboration  system  during  the  DIGEX  which  caused  many  potential  remote 
participants  to  log  off  after  repeated  attempts  to  join  back  in.  This  impact  was  felt  in  Day  2 
where  only  one  of  the  participants  returned  to  the  online  DIGEX.  In  the  ACME  Lab  where 
the  DIGEX  was  physically  hosted,  microphones  and  the  integrated  sound  system  enabled 
verbal  communication  to  remote  attendees.  Normally  this  works  well  with  echo 
cancellation  for  teleconferences.  However,  DCO  did  not  have  typical  telecon  support,  so 
remote  users  needed  to  talk  and  listen  through  their  computers  to  participate.  Use  of  this 
computer  audio  stream  caused  feedback  problems  for  the  room  audio  system  so  instant 
messaging  chat  was  used  via  DCO  to  receive  communications  from  remote  participants. 
This  mode  of  operation  made  customer  service  for  the  DIGEX  community  very  difficult. 


4.3.4  What  could  be  done  better 

A  prime  opportunity  for  improvement  is  the  pre-event  collaboration  with 
attendees/vendors.  We  could  do  better  asking  specific  questions  of  each  potential  attendee 
about  what  would  provide  value  to  them  from  a  DIGEX.  From  talking  to  several  of  the 
participants,  the  DIGEX  could  potentially  be  its  own  virtual  event  considered  “always  on" 
for  a  few  days.  This  does  not  necessarily  have  to  coincide  with  the  dates  of  the  CoT  UG 
event.  During  the  CoT  UG,  it  may  be  useful  to  have  more  of  a  "show  floor”  where  vendors 
could  show  off  their  CoT  capability.  If  simulation  support  is  needed,  REACT  could  provide 
tailored  CoT  feeds  for  participants. 

While  we  held  many  pre-event  coordination  and  brainstorming  meetings,  various  risks  that 
were  identified  early  on  such  as  external  network  access  were  only  able  to  be  mitigated  at 
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the  last  minute  due  to  ISEE  staffing  availability.  REACT’s  game  and  simulations  use 
commercial  Internet  services  from  Mapquest  for  maps  and  road  routing  so  the  availability 
of  that  access  from  the  DIGEX  network  was  critical.  During  the  event,  this  access  worked 
very  well. 

The  REACT  DIGEX  game  worked  as  expected  but  we  could  have  done  a  better  job 
explaining  what  the  players  could  expect  from  the  gameplay.  A  tutorial  would  address  this 
concern. 


4.4  Requirements  Gathering 

MITRE’s  2C130  auditorium  has  been  upgraded  since  2013  and  the  new  features  enhanced 
this  year’s  user’s  Group  Meeting.  The  new  teleprompter  supported  an  ability  to  monitor 
DCO  chat  comments,  and  the  improved  audio  capabilities  enabled  better  communication 
with  remote  participants. 

As  with  the  ACME  lab,  multiple  system  tests  were  conducted  to  ensure  that  audio,  video, 
and  integration  with  the  Collaborative  Story  Development  Kit  were  operational. 

In  order  to  set  the  stage  for  capture  of  requirements,  we  presented  an  overview  of  FY14 
activities  and  potential  FY15  priorities.  The  CoT  team  distributed  laminated  cards  and 
Dry-Erase  markers  to  the  seating  table  areas  prior  to  the  start  of  session;  during  the 
overview  users  were  encouraged  to  write  their  ideas  down.  After  the  overview,  we 
collected  the  cards  and  began  the  requirements  discussion. 

The  following  images  are  screen  shots  of  various  points  in  the  discussion  process.  You  will 
note  that  the  number  of  items  increase  along  with  an  attempt  to  organize  the  emerging 
consensus. 
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The  following  requirements  are  listed  in  order  of  priority: 

•  Exercise  Support:  support  at  least  one  exercise  in  FY15.  Colonel  Butow 
(Commander,  129th  Rescue  Wing)  recommended  that  participation  in  exercise 
SOARING  ANGEL  in  FY15  would  address  not  only  user  requests  for  support  of 
Personnel  Recovery,  but  also  facilitate  planning  for  his  organization’s  deployment  in 
FY15. 

•  Establishment  of  a  CoT  Mil-Standard 

•  Development  of  CoT  Open  Source:  we  are  looking  to  provide  more  flexibility  with 
regard  to  development  and  dissemination  of  user-initiated  CoT  applications 

•  Coordination  of  military  assets  in  a  non-traditional  space 

a.  Chemical  /  Biological  /  Radiological  /  Nuclear  /  Enhanced  Conventional 
Weapons  defense 

b.  Natural  Disaster  response 

c.  Integration  with  Department  of  Homeland  Security 

•  Emergency  Medical  Support:  this  priority  aligns  itself  with  the  Personnel  Recovery 
mission. 

•  Expansion  of  the  CoT  SDK:  we  received  several  requests  for  development  of  a  C++ 
COT  SDK. 

•  User  training  /  dissemination  of  “best  practices” 


Although  user  feedback  was  generally  positive,  we  received  comments  indicating  that 
attempting  to  conduct  both  the  DIGEX  and  Requirements  Gathering  session  in  parallel  was 
a  mistake.  There  were  multiple  users  who  wanted  to  attend  both  sessions,  and  were 
unable  to  do  so. 
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4.5  ACME  Lab  support 

Major  tasks  associated  with  this  year’s  CoT  User  Group  meeting  included: 

•  Designing  ACME  Lab  floor  space  and  systems  network  (DIGEX  REACT,  CoT 
Systems  interaction,  Vendors,  Collaborative  Story  Development  Kit) 

•  Evaluating  and  testing  the  DCO  system  with  the  MITRE  Corporate  staff  and 
systems. 

•  System  integration  testing 

•  Development  and  production  of  artwork  supporting  the  meeting  (e.g.,  CoT  - 
Enabled  System  information  boards) 

•  Coordination  with  Corp  Audio  Visual  staff  for  production  of  the  meeting  and 
capture  of  presentations  for  future  distribution) 

•  Post-Event  audio  /  video  processing 

During  the  event  our  MITRE  staff  worked  as  part  of  the  CoT  team,  supporting  online 
attendees  and  working  to  assure  acceptable  quality  of  digital  and  video  feeds  for  virtual 
attendees. 

4.5.1  What  went  right 

We  set  up  a  live  feed  from  the  main  conference  room  (the  auditorium,  2C130)  just  outside 
the  ACME  lab.  This  was  extremely  helpful  for  the  DIGEX  and  meeting  participants  who 
needed  to  be  in  two  places  at  once,  allowing  them  to  focus  on  their  primary  tasks  in  the 
ACME  lab  but  also  listen  to  the  meeting.  We  observed  constant  traffic  past  this  live  feed, 
with  people  watching  for  a  short  time  before  either  taking  up  tasks  in  the  ACME  lab  or 
deciding  to  join  the  activities  in  the  auditorium. 

We  found  that  our  communication  plan  was  effective.  We  wrote  an  article  for  the 
Hansconian  (Hanscom  Air  Force  Base’s  weekly  publication),  and  this  generated  increased 
local  interest  in  the  meeting.  We  employed  MITRE’s  corporate  services  such  as  MAID, 
Community  Share,  Morning  emails,  and  corporate  print  services  to  publicize  the  meeting  to 
MITRE  staff  and  external  stakeholders.  The  CoT  Program  Office  sent  monthly  emails  to  the 
1700+  member  of  the  user  group,  starting  in  January;  these  emails  became  weekly  emails 
during  the  four  weeks  prior  to  the  User  Group  Meeting. 

We  leveraged  MITRE’s  Audio  Visual  team  to  facilitate  recording  of  presentations  and  for 
the  post-meeting  processing  into  video  “chunks”  (15  minute  slices  of  a  presentation)  which 
we  believe  to  be  valuable  for  users  who  cannot  devote  an  hour  to  watching  a  presentation. 
In  past  years  we  have  received  positive  feedback  from  users  who  were  unable  to  attend  the 
meeting,  but  who  could  review  the  presentations  at  a  later  date.  We  anticipate  similar 
feedback  this  year.1 


1  Note :  these  chunks  have  been  developed  so  that  “slice  2"  overlaps  the  end  of  "slice  1"  by  approximately  15  seconds, 
giving  the  viewer  an  ability  to  re-engage  on  a  presentation  when  viewing  has  been  interrupted. 
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The  Requirements  Gathering  audience  (approximately  30  people  both  physically  in 
Bedford  and  virtually  participating  via  DCO),  were  able  to  interact  and  contribute  their 
individual  ideas  while  also  given  an  opportunity  to  elaborate  verbally. 

There  was  a  teleprompter  view  for  Jon  Jacoby  so  he  could  see  the  "live”  online  audiences 
ideas  and  incorporate  them  instantly  during  the  collaborative  session. 

The  COps  room  of  the  ACME  lab  was  configured  for  two  offline  breakout  sessions  ("CoT 
SDK”  and  "CoT-101”).  Both  sessions  were  well  attended,  and  indicate  a  continuing  need  for 
CoT  training  and  education. 

4.5.2  What  could  be  improved  --  Recommendations  for  next  year 

The  ACME  lab  could  have  been  better  utilized.  While  the  room  design  supported  many 
people  interacting  with  the  DIGEX  and  provided  space/network/tables  for  11  separate  CoT 
systems  to  set  up  and  share  their  work,  there  was  only  one  group  that  took  advantage  of 
the  resources.  Either  we  overestimated  the  requirements,  or  we  were  unable  to  generate 
sufficient  interest  for  using  the  lab  as  we  had  envisioned. 

We  did  not  remember  to  have  presenters  remove  their  badges;  in  some  cases,  this  caused 
problems  with  video  captures. 

We  need  to  remind  audience  members  to  use  the  microphones  (either  on  the  table,  or  the 
handhelds)  when  they  ask  a  question.  We  may  failed  to  capture  important  dialog  and 
information  in  the  conference  room. 

The  DIGEX  could  have  employed  more  instructional  material,  e.g.: 

•  Posters  explaining  how  to  leverage  this  exercise 

•  Background  information  on  the  DIGEX,  how  it  can/does  interact  with  systems,  and 
desired  outcomes 


4.6  Presentations 

4.6.1  CoT-NIEM 

The  purpose  of  the  CoT-NIEM  presentation  was  to  introduce  the  CoT  community  to  the  CoT 
Program  Office’s  effort  to  create  a  National  Information  Exchange  Model  (NIEM)-based 
serialization  of  the  CoT  paradigm.  The  presentation  gave  an  overview  of  NIEM,  explained 
why  the  CoT-NIEM  effort  was  undertaken,  and  explained  the  deliverables  of  the  CoT-NIEM 
effort.  The  deliverables  included  the  CoT-NIEM  information  exchange,  and  a  CoT-NIEM 
translator  that  is  able  to  do  a  lossless  translation  between  CoT-NIEM  and  CoT  v2.0. 

The  presentation  was  well  received,  and  prompted  several  questions  including: 

•  Q:  How  will  CoT-NIEM  work  in  bandwidth  reduced  environments?  A:  Either 
compress  or  use  CoT  v2.0 

•  Q:  Does  CoT-NIEM  complement  CoT  v2.0  or  will  it  take  over  as  the  next  version  of 
CoT  v2.0?  A:  CoT-NIEM  complements  CoT  v2.0.  It  is  a  NIEM-based  serialization  of 
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the  CoT  v2.0  concepts  meant  to  enable  systems  using  NIEM-conformant  exchanges 
to  utilize  the  CoT  paradigm  and  existing  CoT  resources. 

•  Q:  How  does  CoT-NIEM  handle  community  extensions  for  typing  and  subschemas? 
Al:  CoT-NIEM  has  a  field  with  an  enumeration  for  the  CoT  types  distributed  by  the 
CoT  program  office.  Additionally,  it  has  a  type  extension  field  to  enable  users  to  add 
additional  typing  information  to  the  type  hierarchy  as  they  see  fit.  A2:  CoT-NIEM 
contains  NIEM  versions  of  the  stable  CoT  subschemas  provided  by  the  CoT  program 
office.  Additionally,  it  has  a  community  extensions  field  that  allows  users  to  provide 
any  information  they  deem  necessary  to  augment  the  CoT-NIEM  message. 

•  Q:  How  long  do  you  anticipate  the  NIEM  CIO  guidance  persisting  in  the  DoD  domain? 
A:  Unknown.  NIEM  was  originally  developed  as  a  grounds-up  effort  within  the 
Department  of  Justice.  It  was  later  also  adopted  by  the  DHS  and  has  seen  success  in 
those  realms.  DoD  adoption  facilitates  future  interoperability  efforts.  Our  goal  for 
providing  the  CoT-NIEM  translator  at  this  point  is  to  get  out  ahead  of  the  NIEM 
effort  and  give  it  every  possible  chance  of  succeeding  in  the  DoD. 

Additionally,  the  CoT-NIEM  team  set  up  a  lunch-time  demo  of  the  CoT-NIEM  translator.  It 
was  poorly  attended,  but  they  were  able  to  show  the  demo  to  a  large  crowd  during  the 
DIGEX  demo  period. 

4.6.2  CoT  SDK  2.0 

Expanding  domestic  and  international  interest  in  CoT  has  resulted  in  a  steady  stream  of 
new  Cursor  on  Target  users  seeking  information  on  how  to  quickly  CoT-enable  their 
systems.  These  new  users  were  the  focus  of  the  Day  One  presentation:  CoT  Overview  and 
Software  Development  Kit  (SDK)  (LBonanno,  CPeers,  KGibson). 

As  background,  the  CoT  SDK  is  a  software  library  intended  to  lower  the  barrier  of  entry  for 
new  Cursor  on  Target  developers.  The  SDK  consists  of  common  code  to  construct,  parse, 
and  manipulate  CoT  event  messages.  By  leveraging  this  common  code,  developers  are  able 
to  focus  on  their  system  specific  details  and  build  out  a  CoT  plugin  more  rapidly.  The  SDK’s 
overarching  principle  is  to  favor  simplicity  over  power  and  complexity,  and  make  it  difficult 
for  users  to  create  an  invalid  CoT  message.  Version  1.0  of  the  CoT  SDK  was  delivered  to  the 
CoT  user  Community  in  April  of  2013.  Version  2.0  is  an  extension  of  Version  1.0,  and  it  will 
be  delivered  to  the  CoT  user  Community  in  May  of  2014. 

For  the  briefing,  two  MITRE  conference  rooms  were  used  in  an  effort  to  target  the  different 
technical  levels  of  the  general  audience.  First,  room  2C130  (auditorium)  was  used  to 
present  the  CoT  and  SDK  high  level  overview.  Users  gained  understanding  of  what  it 
means  to  "CoT-enable”  a  system  and  how  to  use  the  CoT  SDK  without  looking  at  a  single 
line  of  code.  Users  were  highly  engaged  during  the  briefing,  and  asked  many  questions. 
Secondly,  an  ACME  classroom  was  used  to  dig  into  the  code  and  demonstrate  actual  usage 
of  the  SDK.  The  room  had  three  stations  set  up  for  hands-on  coding  example 
demonstrations  (java  SDK,  .NET  SDK,  networking  demonstrations).  Users  were  able  to 
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visit  the  stations,  ask  specific  coding  and  architecture  questions,  and  get  comfortable  with 
the  SDK  tools  and  usage. 

The  two  room  format  was  very  effective.  The  following  observations  were  noted  during 
the  presentation  and  demonstrations: 

•  Users  want  to  learn  about  CoT  tasking.  A  CoT  Tasking  101  would  be  well 
received  during  next  year’s  conference. 

•  Users  want  guidance  with  respect  to  CoT  and  mobile  applications.  Questions 
were  raised  about  CoT  and  transport. 

•  There  are  new  users  at  the  CoT  meetings  every  year,  and  they  are  very 
interested  in  a  basic  CoT  overview.  They  want  to  learn  exactly  it  means  to  CoT- 
enable  a  system.  They  want  to  understand  how  to  write  and  effectively  debug  a 
CoT  plugin.  They  want  to  learn  more  about  the  tools  to  help  them  CoT  enable 
their  system  (SDK,  Debug  Tool,  FVCoT,  etc.) 

•  Users  would  like  a  C++  SDK  library 

•  Users  would  like  additional  subschema  support  in  the  CoT  SDK 

4.6.3  CoT  Mil-Standard 

MITRE  provided  an  update  on  the  status  of  MIL-STD  development  and  presented  issues 
raised  by  the  AFSIB  (Air  Force  Standards  Interoperability  Board)  in  their  review  of  the 
current  draft.  The  AFSIB  is  the  Air  Force  representative  to  US  Joint  standards  boards,  and 
is  responsible  for  proposing  new  MIL-STDs  for  approval  of  the  Joint  community,  as  well  as 
representing  Air  Force  interests  in  configuration  management  decisions. 

There  was  disagreement  among  the  attendees  concerning  the  value  of  a  CoT  MIL-STD  and 
what  "price”  they  were  willing  to  "pay”  in  terms  of  potential  modifications  to  current  CoT 
practices  and  implementations.  Future  discussions  should  focus  on  the  trade-offs  involved 
and  have  the  goal  of  reaching  consensus.  The  question  of  how  much  influence  the  CoT 
User’s  Group  will  really  have  over  future  direction  of  the  CoT  standard  also  needs  to  be 
considered  by  the  CoT  Program  Management  Office. 

The  CoT  Program  Management  Office  has  the  final  say  in  how  to  move  forward  with 
changes  to  Cursor  on  Target.  But  if  this  is  not  in  line  with  what  the  users  want,  other 
stakeholders  (e.g.,  the  AFSIB)  will  have  questions  concerning  those  decisions  and  approval 
of  the  CoT  MIL-STD  could  be  delayed. 
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5  Attendee  Meeting  Feedback 
5.1  Assessment:  What  the  Feedback  tells  us 

While  the  number  1  priority  for  attending  was  the  presented  material,  “networking”  was 
also  very  high  on  the  list.  Some  of  the  comments  (see  para.  5.4)  indicate  that  we  need  to 
enhance  the  ability  of  attendees  to  meet  with  each  other  and  investigate  opportunities  for 
collaboration. 

Our  selection  of  the  MITRE  facilities  was  a  good  one,  and  the  hard  work  performed  by  the 
architecture  team  to  ensure  that  audio  and  video  were  accessible  /  stable  paid  dividends. 

Users  were  asked  to  pick  their  top  three  presentations  on  both  days.  On  Day  1,  by  the 
metrics  of  "Most  Interesting”  and  "Total  Votes”,  AFRL’s  ATAK  presentation  and  the  ForceX 
presentation  on  use  of  CoT  in  Fire  Fighting  were  the  clear  favorites. 

On  Day  2,  there  was  less  correlation  between  "Most  Interesting"  and  "Total  Votes”.  The 
favorite  presentations  on  Day  2  were  BAO  Kit  and  ATAK,  but  the  total  number  of  votes  for 
each  presentation  were  relatively  equal: 

•  BAO  Kit:  21 

•  Small  UAV  Geo-location:  16 

•  Mil-Standard:  16 

•  ATAK:  15 

•  Wide  Area  Surveillance:  14 

•  CoT-NIEM  Integration:  13 

Given  the  comments  concerning  Use  Cases,  it  would  appear  that  attendees  are  hungry  for 
real-world  applications  of  CoT  technology. 

The  lack  of  feedback  on  Day  1  virtual  attendance  would  appear  to  reflect  the  problems  we 
had  with  DCO  connectivity.  Another  possibility  is  that  feedback  was  not  collected  until  Day 
2,  and  the  Day  2  assessments  reflect  ratings  for  both  days. 

It  appears  that  the  User  Group  Meeting  satisfied  user  expectations. 
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5.2  General  feedback 


Reasons  for  Attending 


Content  Networking  Speakers  Digital  Exercise 


Physical  Attendee  ratings 


■  Facilities 
Audio/Visual 

■  Food 

■  Overall 
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Did  Meeting  Meet  Your  Expectations? 


Page  26  of  50 


After  Action  Report:  International  CoT  User  Group  Meeting  (1-2  April  2014) 


5.3  Day  1  feedback  (International  Day) 
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5.4  Day  2  feedback  (US-only  participation) 


Day  2  Connectivity 
(Virtual  Attendees) 


w  Outstanding 
Very  Satisfied 

■  Satisfied 

■  Somewhat  Satisfied 

■  Unsatisfield 

Audio/Video  Effectiveness  Overall 
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Requirements  Gathering 


w  Audio/Video 
"  Effectiveness 
w  Overall 


Satisfied 


Satisfied 
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5.5  Survey  Comments 


Most  Beneficial  aspect  of  meeting? 

How  can  we  improve  the  meeting? 

What  other  topics  are  of  interest  to  you? 

Networking  (Talking  with  other  users) 

Break  down  into  use  cases  before  getting  into 
technical  details 

Use  cases,  DoD  vs  Civilian 

Networking  (interacting  with  a  wide 
group  of  users) 

DIGEX  should  not  be  run  concurrently  with 
other  briefings 

Briefings  (Learning  about  new  initiatives, 
innovation  &  future  challenges) 

More  on  domestic  operations 

DIGEX  data 

Explain  conventions  around  standard  use 

Integrating  CoT  in  High  Availability  /  Disaster 
Recovery 

Content  &  Networking 

Would  like  to  know  more  about  what  others 
are  doing  with  CoT 

Add  speaker  contact  info  to  the  agenda 

Networking  (interactive  discussions  with 
other  attendees  &  speakers) 

Use  Cases,  additional  schemas 

data  flows  (not  just  schema  definitions) 

CoT  Basics  (understanding  what  CoT  is 
and  how  it  is  used) 

Make  the  briefing  slides  available  prior  to  the 
briefing  for  ease  of  note  taking 

Content  (speakers,  sidebars,  etc.) 

CoT  West!  (not  sure  what  that  comment 
means) 

Content  (presentation) 

Hard  to  say 

DHS  All-Hazards  (Disaster  &  Terrorist 

Response) 

CoT  Basics  (gave  me  needed  exposure  to 
CoT;  what  it  does  and  what  it  could  do) 

Networking  (contact  with  military 
personnel  &  vets  who  use(d)  digital 
tactical  systems 

More  scheduled  time  for  networking 

Content  (education  on  the  potential  uses 
for  CoT) 

Wished  for  more  education  opportunities  as 
opposed  to  briefings 

More  focus  on  operational  use  of  CoT 
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Most  Beneficial  aspect  of  meeting? 

How  can  we  improve  the  meeting? 

What  other  topics  are  of  interest  to  you? 

Content/Networking  (presentations  and 
discussions) 

Recommend  "CoT  Introduction"  session  on  the 
day  prior  to  the  conference  for  new  folks 

Good  for  now 

CoT  Basics  (learning  about  CoT  &  how  it's 
used) 

Content  (learning  about  other  users  & 
their  use/application  of  CoT) 

Networking  (contacts) 

More  specifics 

Specific  message  to  get  a  task  done,  access  to 
documentation 

MITRE  staff 

more  Networking 

Networking  (finding  POC/SME  on  CoT) 

None 

Can't  think  of  anything  besides  what  was 
addressed 

Support  (getting  long  standing  issues 
addressed  and  ironed  out) 

CoT  to  KLV  translation,  CoT  Security 

Content/Networking  (meeting  &  demo 
w/CoT  users) 

Networking  (collaboration  conversations) 

Vet  slides;  truth  in  advertising 

Use  of  CoT  for  data  normalization.  Intelligence 
capabilities.  First  Responder/Medical  sub  set, 
suggest  cool  fire  technologies 

CoT  Basics?  (Tutorial) 

Parking 

More  info  on  subschemas  &  guidelines 

Networking  (CoT  users  1  don't  get  to  see 
on  a  regular  basis) 

maybe  an  hour  set  aside  for  extra  discussions 
between  vendors 

SIGINT 

Networking  (interaction  with  other  users 
in  the  community) 

Content/Speakers 
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Most  Beneficial  aspect  of  meeting? 

How  can  we  improve  the  meeting? 

What  other  topics  are  of  interest  to  you? 

Hearing  where  things  are  going. 

Definitely  want  CoT  to  be  standardized. 

Provide  at  least  a  temporary  password  or 
similar  to  get  to  the  CoT  schemas,  debugger 
etc.  for  downloading. 

Before  the  next  meeting,  take  in  written 
questions  regarding  the  use  and  applications 
of  Cot.  My  interest  is  specifically  using  CoT  to 
produce  9-line  targets  etc.,  what  CoT 
messages  are  used  to  provide  the  9-line 
functionality,  and  what  are  the  limitations. 

What  are  the  typical  start,  stop  and  stale  time 
settings  etc. 

Learning  about  the  range  of  current  CoT 
applications,  and  developmental  issues. 

Encourage  more  foreign  participation, 
especially  in  Bedford. 

Warfighter  perspective  (e.g.  Mr  Danforth 
from  BAO  kit  office) 

Android  Tactical  Assault  Kit  presentation 

Learning  about  how  others  use  CoT  and 
using  that  knowledge  to  consider  new 
implementation/enhancement  to  my 
organization's  projects. 

1  thought  the  content  was  all  good.  1  can't 
think  of  anything  else. 

The  ISR  briefings 

Information  from  presentations 

Improve  audio  for  remote  viewers,  e.g.  when 
someone  asks  a  question  from  the  audience 
either  repeat  the  question  or  give  them  a  mic! 

Knowledge  and  roadmap  of  CoT  and  see 
uses  in  industry 

If  it  is  kept  as  a  two  day  personal  meeting,  1 
don't  have  much  input  as  1  attended  virtually. 

If  virtual  presents  is  going  to  be  adopted,  then 
go  for  shorter,  more  frequent  meetings, 
perhaps  "webinars"  on  specific  topics.  8  hours 
per  day  was  a  long  time  to  hang  out  on  an 
internet  connection. 
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Most  Beneficial  aspect  of  meeting? 

How  can  we  improve  the  meeting? 

What  other  topics  are  of  interest  to  you? 

Networking/Presentations  (came 
specifically  for  Ralph  Kohler's 
presentation,  networking  also  good) 

Arrange  so  there  is  no  overlap  between  DIGEX 
&  presentations;  that  would  be  optimal 

Progress  toward  implement  CoT  in 
international  community  (approved  TAA's  or 
licenses) 

Learning  about  current  CoT  status 

Additional  Comments 

•  Arrangements  for  virtual  participation  very  well  done. 

•  Good  Job  staying  on  schedule! 

•  Need  to  ensure  audience  participants  have  microphone,  when  asking  questions,  etc.! 

•  Working  through  local  network  politics  so  hopefully  we  can  participate  in  DIGEX  next  year.  It  was  better  this  year  with  the  pre-tests;  at 
least  I  knew  what  the  problem  was,  unfortunately  the  wheels  of  government  grind  too  slowly.  Perhaps  putting  out  ports  and  protocol 
with  initial  meeting  notice  would  help  facilitate  coordination  of  opening  ports  and  protocols  so  we  can  participate  next  year.  Connection 
dropped  out  periodically,  speaker  had  to  be  reminded  to  talk  into  mic,  but  all-in-all  was  easy  to  use  and  follow. 

•  BAO  Kit  briefing  was  very  enlightening. 

•  I  love  the  MITRE  campus! 

•  Very  profession  meeting.  All  my  requirements  were  addressed.  Thank  you! 

•  I  wanted  to  participate  in  the  DIGEX  but  the  network  Nazis  on  my  end  wouldn't  open  up  the  ports! 

•  Did  come  away  from  DIGEX  with  an  understanding  of  what  the  CoT  routers  do. 

•  Disagree  with  prioritizing  DIGEX  &  taking  time  from  requirements  gathering  and  question  doing  requirements  last  when  many  have 
already  left  for  the  airport. 

•  The  DIGEX  scenarios  demonstrated  a  realistic  application  of  CoT. 

•  Would  like  to  see  incorporation  of  multi-sensor  platforms  in  the  DIGEX. 

•  Great  experience.  Have  much  better  understanding  of  what  CoT  is.  Very  well  run  user  group 

•  Thanks  for  all  the  support,  very  good  conference  &  I  appreciate  the  opportunity  to  attend. 
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Bill  Leavis  and  Col  Anthony  Genatempo  (AFLCMC/HNA)  2C130  Auditorium  /  ForceX  presentation  (Luke  Savoie) 
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ACME  Lab  Mike  Dinsmore  (MITRE)  conducts  briefing  on  REACT  simulation 
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DIGEX  preparation  DIGEX  preparation 
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DIGEX  evaluation  Ernie  Carozza  (MITRE) 
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7  Summary 


The  FY14  Cursor  on  Target  Annual  User  Group  Meeting  took  into  account  the  growing 
number  of  CoT  users,  their  need  to  minimize  travel  costs  due  to  Sequestration,  and 
continued  last  year’s  efforts  to  incorporate  participation  by  International  stakeholders.  In 
doing  so,  we  successfully  leveraged  a  new  architecture  incorporating  Defense  Connect 
Online  and  MITRE’s  Information  Sharing  Experimentation  Environment,  developing  a 
capability  which  should  be  able  to  meet  the  needs  of  future  CoT  education,  training,  and 
collaboration  requirements. 
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Appendix  A:  CoT-enabled  System  Poster  Samples? 


Reference  to  any  specific  commercial  product,  process,  service,  manufacturer  or  company 
does  not  constitute  an  endorsement,  recommendation  or  favoring  by  the  U.S.  Government 

or  the  MITRE  Corporation. 


2  Some  posters  could  not  be  included  due  to  the  requirements  for  Public  Release 
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Cursor  on  Target 
Users  Group  2014 


cursor 

ON  TARGET 


05 


VIStology,  Inc. 


Description  of  technology: 


Name:  VIStology  HADRian 

Primary  Objective: 

Provide  near-Real  Time  Situational  Awareness  to  HA/DR  incident  commanders 
Sub-Objective:  Dynamically  integrate  multiple  information  streams 

(CoT  and  not)  into  COP  for  HA/DR  ops  by  means  of  semantic  annotations 

Issue  that  technology  attempts  to  resolve: 

>  Selective  integration  of  ad  hoc  sensor  information  into  COP  via  machine  reasoning 

>  HA/DR  EEI  (Essential  Elements  of  Information)  answering  from  social  media  and  other  information 

>  Geofencing 

HADRian  is  next-generation  Common  Operational  Picture  software  for 
HA/DR  ops.  HADRian  enables  an  Incident  Commander  to  Find,  Filter, 
Geocode,  Display  and  Dispatch  the  information  necessary  to  make  the 
best  decisions  about  the  situation  on  the  basis  of  semantic  annotation  of 
information  repositories.  Repositories  or  information  streams  that  are 
integrated  into  the  HADRian  COP  can  include  text  reports,  social  media, 
photos,  streaming  or  static  video,  traffic  cameras,  GPS  tracks,  chemical 
plumes,  3D  building  models  (SketchUp)  and  other  sources  of  information  a 
they  are  identified. 

Brian  Ulicny  PhD  Phone:  (508)  788-5088 

bulicny@  vistology.  com  >  VIStology  com 

ina  ontroWatatb  the  Tactf . 

distribution  A.  Approved  for  Public. Release,  distribution  unlimited- 


Contact  Name: 
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cursor 

ON  TARGET 


Name:  ARC3  (Augmented  Reality  Command,  Control,  Communicate) 


Primary  Objective: 

Deliver  heads-up  visualization  of  tactical  geo-registered 
information  for  dismount  operations  and  immersive  training 

Sub-Objective: 

>  Provide  real-time  SA  (e.g.,  blue  forces,  aircrafts,  GCMs, 
avatars)  on  see-through  displays  and  night-vision  goggles 

Issue  that  technology  attempts  to  resolve: 


NVG 


>  Heads-up  access  to  SA  eliminates  need  to  look  down  at  computing  devices 

>  Delivers  overmatch  capability  to  the  infantry  squad 

>  Enhances  protection,  lethality,  and  mission  OPTEMPO 

Description  of  technology: 

Accurate  mobile  outdoor  head  tracking;  low-latency  rendering  in  through-sight 
displays;  interfaces  to  CoT  network  to  support  small-team  coordination 


See-through  display 


Contact  Name:  Dave  Roberts 

Email:  droberts@ara.  com 


Phone:  919-582-3300 
We  bs  i  te :  www.  ara.  com 


* Technology  developed  on  DARPA  ULTRA-Vis  program  and  ARA  IR&D 

■  ,  J<&!njg£2jjrrm 


Distribution  A:  Approved  for  Public  Release, 
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Cursor  on  Target 
Users  Group  2014 


Name:  Mission  Planning  -  ctMPS™/CoT 


Primary  Objective: 

To  demonstrate  real-time  Collaborative  Mission  Planning  using  CoT. 

Sub-Objective: 

To  demonstrate  /  evaluate  CoT  feeds  in  Collaborative  Mission  Planning. 


Reduce  Tactical  Mission  Plan  Generation  Times 
Reduce  Communication  Related  Data  Errors  and  Eliminate  Replanning 
Enable  Machine  to  Machine  (M2M)  Communications  for  Rendezvous  Points 
-  Targeting,  Refueling,  Multi-Modal  Routing 

Description  of  technology: 

ctMPS™  provides  real-time  collaborative  mission  planning  for  tactical  units  as  an  add-on  to  PFPS. 
By  including  support  for  CoT  subscription  /  publication,  we  will  enable  M2M  communication  with 
ctMPS™  capable  mission  planning  cells  to  coordinate  tactical  planning  in  real-time. 


Contact  Name:  Joshua  Trainer  Phone:  401  234  1145 

Email:  JTrainer@CollaborationTech.net  Website:  www.CollaborationTech.net 


Distribution  A.  Approved  for  Public  Release,  distribution  unlimited 
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Name: 


Cursor  on  Target 
Users  Group  2014 


cursor 

ON  TARGET 


CoT-Enabled  Link- 1 6  DLP  and  Simulator 


Primary  Objective: 

Shared  Situational  Awareness  between  Link- 16  and  CoT  tactical  edge  networks 


Tactical  CcxTirnunicstMns  Group,  ll_C 

Sub-Objective: 

Provide  a  tactical-oriented  testing,  simulation,  and  operations  software  suite  for  UxV  payloads 


Issue  that  technology  attempts  to  resolve: 

Real-time  communication  between  multiple  Link  16  networks  and  multiple  CoT  networks 
is  required  to  enhance  situational  awareness  between  tactical  edge  warfighters  on 
different,  possibly  disconnected,  data  links. 

Description  of  technology: 

A  beyond-line-of-sight  UAV  multi-link  communications  payload  with  native,  automated, 
unattended  Link- 16  and  CoT  data  link  processing,  translation,  routing,  and  multi-radio  control 

Network  and  radio  simulation  and  testing  using  TCG’s  CoT-Enabled  BOSS 
Harris’  TEN-G  and  TCG’s  CoT-Enabled  Link- 16  data  link  processor  and  radio  control 


Contact  Name:  Peter  Ellis  Phone:  978-654-4800 

Email:  Peter.Ellis@g2tcg.com  Website:  www. g2tcg.com 
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Cursor  on  Target 
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cursor 

ON  TARGET 


Name:  Portable  Test  Range 


Primary  Objective: 

Demonstrate  flight  test  range  command  and  control  capability 
without  the  need  for  usual  test  range  infrastructure 


Georgia 
Tech 


Problem.  Solved. 


Sub-Objective: 


> Explore  alternatives  to  the  usual  U DP  and  TCP  for  CoT  message  transport 


Issue  that  technology  attempts  to  resolve: 


> Develop  a  messaging  architecture  that  is  easier  and  more  reliable  than  current  techniques 
> Develop  a  messaging  architecture  that  simultaneously  supports  CoT  and  other  protocols 
>  Explore  the  efficacy  of  alternative  comm  channels  such  as  cell,  Iridium,  Inmarsat,  Point  to  Point 


Description  of  technology: 

The  Portable  Test  Range  (PTR)  demonstrates  test  range  style  TSPI  tracking,  C2,  and  communications 
services  using  a  variety  of  commercially  available  data  link  providers.  A  unique  feature  of  PTR  is  the 
use  of  Publish  -  Subscribe  as  a  network  transport,  greatly  simplifying  network  setup  of  CoT  messaging. 
PTR  is  an  Internal  R&D  Development  program  of  the  Georgia  Tech  Research  Institute. 

Contact  Name:  Bob  Baggerman  Phone:  850-609-2314 

Email:  bob.baggerman@gtri.gatech.edu  Website:  http://www.irig106.org/ptr 


Approved  for  Public  Release.  Distribution  unlimite 
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Cursor  on  Target 
Users  Group  2014 

Name:  TacitView 

Primary  Objective: 

Enable  processing,  exploitation,  and  dissemination  of  FMV. 


Sub-Objective: 

Allows  analysts  to  find,  scrub,  view,  improve,  tag,  edit,  annotate  and  publish 
motion  imagery  across  the  enterprise  during  all  phases  of  exploitation 


cursor 

ON  TARGET 


Issue  that  technology  attempts  to  resolve: 

>  Receive  and  display  CoT  Messages  with  correct  temporal  and  geospatial  characteristics 

>  Single  application  providing  all  elements  required  for  successful  FED 


Description  of  technology: 

Application  with  a  smart  workflow  engine,  TacitView  will  listen  on  an  incoming  UDP  port  and 
publish  CoT  messages  to  an  interactive  3-D  globe  along  with  overlays  of  live  FMV. 


Contact  Name:  Mark  Hary  Phone:  650.627.7622 


Email:  Mark.Flary@2d3sensing.com  Website:  www.2d3sensing.com 
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Appendix  B:  Participant  Statistics 
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DIGEX? 
Cleared 
Total  to  date 


This  table  reflects  the  timeline  associated  with  users  providing  RSVPs  for  the  FY14  Annual  User  Group  Meeting.  "Cleared” 
connotes  an  individual  who  is:  1)  a  US  citizen;  2)  has  a  need  to  know;  and  3]  whose  proof  of  both  has  been  received.  Thirteen 
US  citizens  were  not  allowed  to  participate  in  Day  2  because  they  failed  to  provide  this  information;  the  balance  of  the  un¬ 
cleared  were  foreign  participants  (4  from  Finland,  1  from  the  UK,  1  from  NATO). 
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